Bulwark Webmail Password Exposure Vulnerability in Auth Session API Endpoint

A vulnerability in Bulwark Webmail, prior to version 1.4.10, allowed the GET /api/auth/session endpoint to return the user's plaintext password in the JSON response. This issue exposed credentials to browser logs, local caches, and network proxies. The vulnerability has been patched in version 1.4.10, which now only returns the server URL and username, while session credentials have been moved to a new PUT handler that is protected to prevent cross-origin and unauthorized CLI access.

Impact

This vulnerability allowed for unauthorized exposure of user passwords, which could be intercepted by browser logs, local caches, or network proxies.

Remediation

Users can upgrade to Bulwark Webmail version 1.4.10 or later to address this vulnerability.